Auth Guards

Protect routes with @UseGuards and the AuthGuard helper from @nestjs/passport.

Syntax@UseGuards(AuthGuard('jwt'))

To protect a route, apply an auth guard. The AuthGuard('jwt') helper runs the JWT strategy and blocks requests without a valid token.

Applying it

Add @UseGuards(AuthGuard('jwt')) to a handler or a whole controller. If the token is valid the handler runs and request.user is available; if not, Nest responds with 401 Unauthorized.

Use the @Req() decorator, or a custom decorator, to read the authenticated user.

Example

import { Controller, Get, UseGuards, Req } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Controller('profile')
export class ProfileController {
  @UseGuards(AuthGuard('jwt'))
  @Get()
  getProfile(@Req() req: any) {
    return req.user; // set by the JWT strategy
  }
}

When to use it

A developer applies @UseGuards(AuthGuard("jwt")) to all routes in a controller to require a valid JWT Bearer token for every endpoint in it.
A team creates a JwtAuthGuard class that wraps AuthGuard("jwt") so they can add custom logic (e.g., check token revocation) without touching every route.
An engineer marks a specific login endpoint with @Public() and configures the global JWT guard to skip routes with that decorator.

More examples

Protecting a route with JWT guard

Applies the built-in JWT auth guard to a single route and reads the decoded user from the request object.

import { Controller, Get, UseGuards, Request } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Controller('profile')
export class ProfileController {
  @UseGuards(AuthGuard('jwt'))
  @Get()
  getProfile(@Request() req: any) {
    return req.user;   // set by JwtStrategy.validate()
  }
}

Custom JwtAuthGuard class

Wraps AuthGuard("jwt") in a named class so it can be injected, extended with metadata checks, and reused across the app.

import { Injectable } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Injectable()
export class JwtAuthGuard extends AuthGuard('jwt') {
  // Add custom logic here, e.g. allow @Public() routes
}

Global JWT guard with public bypass

Extends JwtAuthGuard to skip authentication on routes decorated with @Public(), enabling a single global guard for the whole app.

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { AuthGuard } from '@nestjs/passport';

export const IS_PUBLIC = 'isPublic';
export const Public = () => SetMetadata(IS_PUBLIC, true);

@Injectable()
export class JwtAuthGuard extends AuthGuard('jwt') implements CanActivate {
  constructor(private reflector: Reflector) { super(); }

  canActivate(ctx: ExecutionContext) {
    const isPublic = this.reflector.get(IS_PUBLIC, ctx.getHandler());
    return isPublic ? true : super.canActivate(ctx);
  }
}

Discussion

Be the first to comment on this lesson.